CVE-2026-24858

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-24858 9.8

Fortinet · Multiple Products · Added 2026-01-27 · Published 2026-01-27

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

VendorFortinet

ProductMultiple Products

Date added2026-01-27

Due date2026-01-30

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-288

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

NVD: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-29 04:46 UTC

Wall time15.3s

Searches7

Component defaultno (disabled in factory settings, but enabled by default when registering device via GUI unless manually disabled)

Sources https://www.fortiguard.com/psirt?cve=CVE-2026-24858
https://fortiguard.fortinet.com/psirt/FG-IR-26-060
https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026
https://arcticwolf.com/resources/blog/cve-2026-24858/
https://github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass
https://github.com/gagaltotal/cve-2026-24858
https://github.com/b1gchoi/CVE-2026-24858
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
https://github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass/blob/main/README.md

Hunting hypothesis agent

Hunt SOAP POST /remote/logincheck with a <token> FortiCloud JWT and foreign <serialNumber>; watch for Set-Cookie: APSCOOKIE granting admin then unauthenticated /ng/ dashboard access; alert on 'execute bash' via CLI console after SSO login.

Research details

ComponentFortiCloud SSO authentication module across FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiNAC-F, and FortiSwitchManager

PreconditionsFortiCloud SSO must be enabled on the target device (enabled by default when administrators register the device to FortiCare via GUI unless the toggle is manually disabled); attacker must have a valid FortiCloud account with at least one registered device; network reachability to the target device's management interface (typically HTTPS on port 443); target must run a vulnerable firmware version agent

DeliveryCrafted SOAP/XML POST requests to the /remote/logincheck endpoint (or similar SSO login endpoints) using the attacker's FortiCloud SSO authentication token and a target device serial number to bypass authentication and gain administrative access to devices registered to other accounts

Public PoCyes

PoC URLs https://github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass
https://github.com/gagaltotal/cve-2026-24858
https://github.com/b1gchoi/CVE-2026-24858 Third-party repos; verify before use.

Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-26-060

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Attacker obtains a FortiCloud SSO access_token (15-min TTL) from customerapiauth.fortinet.com/api/v1/auth/token using their own account, sends SOAP XML to /remote/logincheck with <serialNumber> of victim device and <token>, receives Set-Cookie: APSCOOKIE granting full admin session; then accesses /ng/ dashboard and uses CLI Console 'execute bash' for root shell; multiple public PoCs confirm this chain; no source-code exploit needed — the bypass is purely a token replay against a mismatched device serial

SummaryCVE-2026-24858 is a critical authentication bypass vulnerability in Fortinet's FortiCloud SSO implementation affecting FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, and other products that allows an attacker with a FortiCloud account and registered device to log into other accounts' devices. Multiple public PoCs exist and the vulnerability was actively exploited in the wild by two malicious FortiCloud accounts before mitigation.

Tia coverage

First reported2026-06-18

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.